Tamper-evident means structurally checkable: altering a record after the fact breaks the math, not a policy. Here is the exact construction — hash, batch, anchor, verify — and what each layer does and does not promise.
Precision matters here. Anchoring proves a record existed and was not altered after commitment — it does not make storage infinite (retention is a plan property; the optional immutable archive is an Enterprise add-on), and it cannot vouch for data that was wrong before it was hashed. That is why the trail records decisions from the enforcement path itself, not self-reported summaries.
A vendor-held log proves what the vendor chose to keep. The question a reviewer actually asks — "could this have been edited?" — deserves a structural answer. When verification needs no cooperation from the party being audited, the answer stops being a negotiation.